Multiple Denial of Service Vulnerabilities in PJSIP pjmedia

The BSI has released an advisory regarding multiple vulnerabilities identified within the PJSIP pjmedia library. These security flaws allow a remote, unauthenticated attacker to initiate Denial of Service (DoS) conditions against services that utilize the affected media processing stack. PJSIP is a widely deployed open-source multimedia communication library used in numerous Voice over IP (VoIP) applications, softphones, and telecommunication infrastructure components. By sending specially crafted network traffic, an attacker can trigger crashes or resource exhaustion within the affected applications. Given the ubiquitous nature of PJSIP in real-time communication systems, organizations relying on softswitches, IP-PBX systems, or custom VoIP applications should review their software dependencies for the affected components and monitor for unexpected service interruptions.

Impact

Successful exploitation of these vulnerabilities leads to a denial of service state, causing affected telecommunications applications or services to crash or become unresponsive. This impact directly threatens the availability of real-time communication services, potentially affecting internal and external telephony operations, contact center availability, and emergency communication pathways. The scope of impact is dependent on the specific deployment architecture of the VoIP infrastructure using the vulnerable pjmedia library version.

Recommendation

• Monitor system logs for repeated application crashes or service restarts for any VoIP or communication applications utilizing PJSIP.
• Identify if any internal telephony or communication platforms incorporate the PJSIP pjmedia library.
• Contact upstream software vendors for internal VoIP and PBX solutions to determine if their products include the vulnerable version of PJSIP and when a security patch will be provided.
• Limit exposure of VoIP signaling and media ports to trusted networks or authorized IP ranges to mitigate the risk of remote exploitation by unauthenticated actors.